Getting started (v2)

Management API v2 is a versioned REST API. v1 is unchanged and remains at /mgt/ with ?key=.

v2 is currently available on the staging portal only.

Base URL

https://ssg-portal-staging.melroselabs.com/mgt/v2

Production (https://ssg-portal.melroselabs.com/mgt/v2) is not enabled yet.

Authentication

Create a management API key in Configuration > Company > User access in the SSG Administration Portal (same keys as v1).

Send the key as a Bearer token. Do not put it in the query string.

Authorization: Bearer <management_api_key>

X-Api-Key: <management_api_key> is also accepted.

Conventions

• JSON request and response bodies, snake_case field names
• Timestamps are ISO-8601 UTC
• Money is { "amount": "89032", "currency": "GBP" }. A stored currency of None is returned as currency: null
• List endpoints return { "data": [...], "has_more": true, "next_cursor": "5", "limit": 5 }
• Pass limit and cursor to page. Default limit is 100 (CDRs up to 10 000)
• Errors use HTTP 4xx/5xx with:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing Authorization Bearer token",
    "request_id": "req_…"
  }
}

Identifiers

Limits

Authenticated calls are limited per SSG (not per key or IP):

• 5 calls/second
• 200 calls/minute
• 8000 calls/hour

Discovery and /public/* are not counted. Over the limit the API returns HTTP 429:

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Each SSG is limited to 5 calls per second, 200 per minute and 8000 per hour.",
    "request_id": "req_…"
  }
}

Retry-After is seconds until the exceeded window resets. Successful and 429 responses also include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.

Inbound SMS

Same as Routing > Inbound SMS > Add MSISDN in the portal: assign a destination number so inbound (MO) SMS is delivered to a customer SMPP account.

curl -sS -X POST \
  -H "Authorization: Bearer <management_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"msisdn":"447700900000"}' \
  https://ssg-portal-staging.melroselabs.com/mgt/v2/smpp-accounts/{system_id}/inbound-msisdns

system_id identifies the customer SMPP account. Non-digits are stripped. HTTP 409 if the number is already assigned on this SSG.

List and remove:

• GET /smpp-accounts/{system_id}/inbound-msisdns
• GET / DELETE /smpp-accounts/{system_id}/inbound-msisdns/{msisdn}
• GET /inbound-msisdns — all assignments for the SSG

Assign an ECMAScript regular expression (same as Add pattern):

curl -sS -X POST \
  -H "Authorization: Bearer <management_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"pattern":"^447[0-9]{9}$"}' \
  https://ssg-portal-staging.melroselabs.com/mgt/v2/smpp-accounts/{system_id}/inbound-msisdn-patterns

URL-encode the pattern in the path (? as %3F):

• GET /smpp-accounts/{system_id}/inbound-msisdn-patterns
• GET / DELETE /smpp-accounts/{system_id}/inbound-msisdn-patterns/{pattern}
• GET /inbound-msisdn-patterns

Content patterns are not in this API yet.

Try it

curl -sS -H "Authorization: Bearer <management_api_key>" \
  https://ssg-portal-staging.melroselabs.com/mgt/v2/customers